Server
by Devolutions
CVEs (96)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-1901 | Med | 0.28 | 4.3 | 0.00 | Mar 5, 2024 | Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable. | ||
| CVE-2024-1898 | Med | 0.28 | 4.3 | 0.00 | Mar 5, 2024 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator. | ||
| CVE-2025-11958 | Med | 0.27 | 4.1 | 0.00 | Oct 22, 2025 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request. | ||
| CVE-2025-13758 | Low | 0.23 | 3.5 | 0.00 | Nov 27, 2025 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. | ||
| CVE-2024-2918 | Low | 0.23 | 3.6 | 0.00 | Apr 9, 2024 | Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request. | ||
| CVE-2026-9249 | Low | 0.20 | 3.1 | 0.00 | May 22, 2026 | Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server… | ||
| CVE-2026-8477 | Low | 0.18 | 2.7 | 0.00 | May 22, 2026 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API… | ||
| CVE-2023-2400 | Low | 0.18 | 2.7 | 0.00 | Jun 20, 2023 | Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access. | ||
| CVE-2026-9248 | Low | 0.17 | 2.6 | 0.00 | May 22, 2026 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * … | ||
| CVE-2021-36382 | Low | 0.17 | 2.6 | 0.00 | Jul 12, 2021 | Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext). | ||
| CVE-2026-9247 | Low | 0.16 | 2.4 | 0.00 | May 22, 2026 | Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions… | ||
| CVE-2026-12117 | 0.00 | — | 0.00 | Jun 16, 2026 | Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request. | |||
| CVE-2026-12105 | 0.00 | — | 0.00 | Jun 16, 2026 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions. | |||
| CVE-2026-11890 | 0.00 | — | 0.00 | Jun 16, 2026 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results. | |||
| CVE-2026-4396 | 0.00 | — | 0.00 | Mar 18, 2026 | Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification. | |||
| CVE-2026-1768 | 0.00 | — | 0.00 | Feb 24, 2026 | A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2025.3.15. |
- risk 0.28cvss 4.3epss 0.00
Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM credentials unavailable.
- risk 0.28cvss 4.3epss 0.00
Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an administrator.
- risk 0.27cvss 4.1epss 0.00
An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.
- risk 0.23cvss 3.5epss 0.00
Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
- risk 0.23cvss 3.6epss 0.00
Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request.
- risk 0.20cvss 3.1epss 0.00
Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server…
- risk 0.18cvss 2.7epss 0.00
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API…
- risk 0.18cvss 2.7epss 0.00
Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database access.
- risk 0.17cvss 2.6epss 0.00
Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * …
- risk 0.17cvss 2.6epss 0.00
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).
- risk 0.16cvss 2.4epss 0.00
Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions…
- CVE-2026-12117Jun 16, 2026risk 0.00cvss —epss 0.00
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.
- CVE-2026-12105Jun 16, 2026risk 0.00cvss —epss 0.00
Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.
- CVE-2026-11890Jun 16, 2026risk 0.00cvss —epss 0.00
Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.
- CVE-2026-4396Mar 18, 2026risk 0.00cvss —epss 0.00
Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.
- CVE-2026-1768Feb 24, 2026risk 0.00cvss —epss 0.00
A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2025.3.15.
Page 5 of 5